Update patch source

4 files changed, 127 insertions, 22 deletions

diff --git a/.SRCINFO b/.SRCINFO
index 907dac1c8b68..2d7da8811cb9 100755
--- a/.SRCINFO
+++ b/.SRCINFO
@@ -4,12 +4,12 @@ pkgbase = linux-bcachefs-git
 	url = https://github.com/koverstreet/bcachefs
 	arch = x86_64
 	license = GPL2
-	makedepends = bc
-	makedepends = git
-	makedepends = inetutils
+	makedepends = xmlto
 	makedepends = kmod
+	makedepends = inetutils
+	makedepends = bc
 	makedepends = libelf
-	makedepends = xmlto
+	makedepends = git
 	options = !strip
 	source = git+https://github.com/koverstreet/bcachefs#branch=bcachefs-v5.0
 	source = git+https://github.com/graysky2/kernel_gcc_patch
@@ -17,6 +17,7 @@ pkgbase = linux-bcachefs-git
 	source = 60-linux.hook
 	source = 90-linux.hook
 	source = linux.preset
+	source = add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch
 	validpgpkeys = ABAF11C65A2970B130ABE3C479BE3E4300411886
 	validpgpkeys = 647F28654894E3BD457199BE38DBBDC86092693E
 	sha512sums = SKIP
@@ -25,15 +26,16 @@ pkgbase = linux-bcachefs-git
 	sha512sums = 7ad5be75ee422dda3b80edd2eb614d8a9181e2c8228cd68b3881e2fb95953bf2dea6cbe7900ce1013c9de89b2802574b7b24869fc5d7a95d3cc3112c4d27063a
 	sha512sums = 2718b58dbbb15063bacb2bde6489e5b3c59afac4c0e0435b97fe720d42c711b6bcba926f67a8687878bd51373c9cf3adb1915a11666d79ccb220bf36e0788ab7
 	sha512sums = 2dc6b0ba8f7dbf19d2446c5c5f1823587de89f4e28e9595937dd51a87755099656f2acec50e3e2546ea633ad1bfd1c722e0c2b91eef1d609103d8abdc0a7cbaf
+	sha512sums = 097f15592a78d1eb400ac57a64a48bc11339664c627b42c094176d7b2cccbccd4fab536e9ba9b2c1198fdc9178d9c25aa5173f18428e4f7679078fbf418bf273
 
 pkgname = linux-bcachefs-git
 	pkgdesc = The Linux-bcachefs-git kernel and modules ~ featuring Kent Overstreet's bcachefs filesystem
 	install = linux.install
-	depends = bcachefs-tools-git
 	depends = coreutils
-	depends = kmod
 	depends = linux-firmware
+	depends = kmod
 	depends = mkinitcpio
+	depends = bcachefs-tools-git
 	optdepends = crda: to set the correct wireless channels of your country
 	backup = etc/mkinitcpio.d/linux-bcachefs-git.preset
 
diff --git a/.gitignore b/.gitignore
index 574f739e854f..8172ce3e87b8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,4 +4,4 @@ kernel_gcc_patch
 *.gz
 *.pkg.tar*
 pkg
-src
+src
\ No newline at end of file
diff --git a/PKGBUILD b/PKGBUILD
index 82c399a94c64..ea1ea3ef2e52 100755
--- a/PKGBUILD
+++ b/PKGBUILD
@@ -59,19 +59,19 @@ _subarch=
 _localmodcfg=
 
 pkgbase=linux-bcachefs-git
-_srcver_tag=5.0.21
-pkgver="${_srcver_tag}.arch1"
+_srcver_tag=5.0.21-arch1
+pkgver="${_srcver_tag//-/.}"
 pkgrel=1
 arch=(x86_64)
 url="https://github.com/koverstreet/bcachefs"
 license=(GPL2)
 makedepends=(
-    bc
-    git
-    inetutils
+    xmlto
     kmod
+    inetutils
+    bc
     libelf
-    xmlto
+    git
 )
 options=('!strip')
 
@@ -91,6 +91,7 @@ source=(
     60-linux.hook  # pacman hook for depmod
     90-linux.hook  # pacman hook for initramfs regeneration
     linux.preset   # standard config files for mkinitcpio ramdisk
+    "add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch"
 )
 validpgpkeys=(
     'ABAF11C65A2970B130ABE3C479BE3E4300411886'    # Linus Torvalds
@@ -101,7 +102,8 @@ sha512sums=('SKIP'
             '5ad7d43b56255c6130deb130bd327f273575f085c81effb9f433d09f13ba90ac6d2cee9d1c7c55fe7a78980bf393fcd06cb4f71b6057ed298e46ffd2b33bcdb5'
             '7ad5be75ee422dda3b80edd2eb614d8a9181e2c8228cd68b3881e2fb95953bf2dea6cbe7900ce1013c9de89b2802574b7b24869fc5d7a95d3cc3112c4d27063a'
             '2718b58dbbb15063bacb2bde6489e5b3c59afac4c0e0435b97fe720d42c711b6bcba926f67a8687878bd51373c9cf3adb1915a11666d79ccb220bf36e0788ab7'
-            '2dc6b0ba8f7dbf19d2446c5c5f1823587de89f4e28e9595937dd51a87755099656f2acec50e3e2546ea633ad1bfd1c722e0c2b91eef1d609103d8abdc0a7cbaf')
+            '2dc6b0ba8f7dbf19d2446c5c5f1823587de89f4e28e9595937dd51a87755099656f2acec50e3e2546ea633ad1bfd1c722e0c2b91eef1d609103d8abdc0a7cbaf'
+            '097f15592a78d1eb400ac57a64a48bc11339664c627b42c094176d7b2cccbccd4fab536e9ba9b2c1198fdc9178d9c25aa5173f18428e4f7679078fbf418bf273')
 
 _kernelname=${pkgbase#linux}
 : ${_kernelname:=-ARCH}
@@ -114,15 +116,15 @@ prepare() {
     echo "-$pkgrel" > localversion.10-pkgrel
     echo "$_kernelname" > localversion.20-pkgname
 
+    # msg2 "Adding patches from Arch Linux kernel repository..."
+    # git remote add arch_stable https://git.archlinux.org/linux.git || true
+    # git pull --no-edit arch_stable "v${_srcver_tag}"
+
     msg2 "Adding patches from Linux upstream kernel repository..."
     git remote add upstream_stable https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git || true
-    git pull --no-edit upstream_stable v${_srcver_tag}
+    git pull --no-edit upstream_stable v"${_srcver_tag//-arch*/}"
 
-    msg2 "Adding patches from Arch Linux kernel repository..."
-    git remote add arch_stable https://git.archlinux.org/linux.git || true
-    # git pull --no-edit arch_stable "v${_srcver_tag}-arch1"
-    git fetch arch_stable "v5.0.13-arch1"
-    git cherry-pick 1ce49fc24c97401dda96f916e0aec1be26e480a8
+    patch -Np1 -i "${srcdir}/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch"
     sed -i -e "s/^EXTRAVERSION =.*/EXTRAVERSION = -arch1/" Makefile
 
     # https://github.com/graysky2/kernel_gcc_patch
@@ -172,11 +174,11 @@ build() {
 _package() {
     pkgdesc="The ${pkgbase/linux/Linux} kernel and modules ${_pkgdesc_extra}"
     depends=(
-        bcachefs-tools-git
         coreutils
-        kmod
         linux-firmware
+        kmod
         mkinitcpio
+        bcachefs-tools-git
     )
     optdepends=('crda: to set the correct wireless channels of your country')
     backup=("etc/mkinitcpio.d/$pkgbase.preset")
diff --git a/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch b/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch
new file mode 100644
index 000000000000..bebeca063807
--- /dev/null
+++ b/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch
@@ -0,0 +1,101 @@
+From 1ce49fc24c97401dda96f916e0aec1be26e480a8 Mon Sep 17 00:00:00 2001
+From: Serge Hallyn <serge.hallyn@canonical.com>
+Date: Fri, 31 May 2013 19:12:12 +0100
+Subject: add sysctl to disallow unprivileged CLONE_NEWUSER by default
+
+Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
+[bwh: Remove unneeded binary sysctl bits]
+Signed-off-by: Daniel Micay <danielmicay@gmail.com>
+---
+ kernel/fork.c           | 15 +++++++++++++++
+ kernel/sysctl.c         | 12 ++++++++++++
+ kernel/user_namespace.c |  3 +++
+ 3 files changed, 30 insertions(+)
+
+diff --git a/kernel/fork.c b/kernel/fork.c
+index b69248e6f0e0..3b1cd11dc6dc 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -104,6 +104,11 @@
+ 
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/task.h>
++#ifdef CONFIG_USER_NS
++extern int unprivileged_userns_clone;
++#else
++#define unprivileged_userns_clone 0
++#endif
+ 
+ /*
+  * Minimum number of threads to boot the kernel
+@@ -1695,6 +1700,10 @@ static __latent_entropy struct task_struct *copy_process(
+ 	if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS))
+ 		return ERR_PTR(-EINVAL);
+ 
++	if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone)
++		if (!capable(CAP_SYS_ADMIN))
++			return ERR_PTR(-EPERM);
++
+ 	/*
+ 	 * Thread groups must share signals as well, and detached threads
+ 	 * can only be started up within the thread group.
+@@ -2528,6 +2537,12 @@ int ksys_unshare(unsigned long unshare_flags)
+ 	if (unshare_flags & CLONE_NEWNS)
+ 		unshare_flags |= CLONE_FS;
+ 
++	if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) {
++		err = -EPERM;
++		if (!capable(CAP_SYS_ADMIN))
++			goto bad_unshare_out;
++	}
++
+ 	err = check_unshare_flags(unshare_flags);
+ 	if (err)
+ 		goto bad_unshare_out;
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index f50f1471c119..7e752540e2a3 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -106,6 +106,9 @@ extern int core_uses_pid;
+ extern char core_pattern[];
+ extern unsigned int core_pipe_limit;
+ #endif
++#ifdef CONFIG_USER_NS
++extern int unprivileged_userns_clone;
++#endif
+ extern int pid_max;
+ extern int pid_max_min, pid_max_max;
+ extern int percpu_pagelist_fraction;
+@@ -517,6 +520,15 @@ static struct ctl_table kern_table[] = {
+ 		.proc_handler	= proc_dointvec,
+ 	},
+ #endif
++#ifdef CONFIG_USER_NS
++	{
++		.procname	= "unprivileged_userns_clone",
++		.data		= &unprivileged_userns_clone,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec,
++	},
++#endif
+ #ifdef CONFIG_PROC_SYSCTL
+ 	{
+ 		.procname	= "tainted",
+diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
+index 923414a246e9..6b9dbc257e34 100644
+--- a/kernel/user_namespace.c
++++ b/kernel/user_namespace.c
+@@ -26,6 +26,9 @@
+ #include <linux/bsearch.h>
+ #include <linux/sort.h>
+ 
++/* sysctl */
++int unprivileged_userns_clone;
++
+ static struct kmem_cache *user_ns_cachep __read_mostly;
+ static DEFINE_MUTEX(userns_state_mutex);
+ 
+-- 
+cgit v1.2.1-1-g437b
+